Security Risk: 
Less Critical
Vulnerability: 
Cross Site Scripting
Affected Versions: 

CiviCRM Versions 5.10.2 and earlier

Fixed Versions: 

CiviCRM Version 5.10.3 and 5.7.4

Publication Date: 
Wednesday, February 20, 2019
Description: 

The "Currency" element of a new pledge was not properly validated, which could potentially lead to a cross-site scripting attack.

Solutions: 

Upgrade to the latest version of CiviCRM

Credits: 

Patrick Figel of Greenpeace for reporting and fixing the issue

References: 

security/core#16